Frequently Asked Questions

Clause 9.2.2 c) of the standard requires objectivity and impartiality of the audit process. It does not prescribe who conducts the audit, and in particular it does not require an external auditor. What matters is that the procedure is impartial. An AI-supported audit therefore needs binding provisions: audit criteria fixed in advance, exclusively documented evidence, strictly read-only access for the agent, and an audit report that is not altered after the fact. Where these safeguards are documented and demonstrable, the procedure conforms to the standard.

Above all, silent inconsistencies across document boundaries. Typical patterns are a released process demanding a form that does not exist; a record overriding a provision of the governing document above it; a claim in the manual for which no evidence is filed; or a due date that does not exist in the calendar. None of these findings requires special intelligence. They require tirelessness and the willingness not to accept a good intention as evidence.

No, and it should not. What works is a clear division of labour: the agents review, find contradictions, propose changes and update documents after a decision. Release stays with the human. In our system the status “released” is set exclusively by management. That is not a technical restriction but a deliberate boundary, because responsibility for a management system cannot be delegated.

All those built on the same structure: governing documents, records, defined intervals, evidence obligations and an external yardstick. That holds for ISO 9001 as much as for ISO 27001, ISO 14001, ISO 27701, TISAX or accreditation schemes in further education, and increasingly for the documentation obligations of the EU AI Act. The more a certification rests on curated, structured knowledge, the greater the leverage of an AI-supported procedure.

The documented truth (how the process is written down), the perceived truth of management (how supervisors believe it runs) and the lived truth in the process (how it is actually carried out day to day). In practice these three almost always diverge, and almost no one sees all three at the same time.

Because AI does not heal an unclean process, it scales it. Only once all three islands have been brought together into a jointly secured view can you sensibly decide where AI delivers real benefit and where it would only make the damage bigger.

Yes, and immediately. Bringing the three views together, clarifying benefit and mandatory gates, and taking the blank-sheet perspective already produce measurable value in their own right, entirely independent of technology.

No. Research (for example Hollnagel's Work-as-Imagined vs. Work-as-Done) shows that the gap is the norm in complex systems. What matters is not that it exists, but that someone builds the bridges.

AI sovereignty means you keep control over models, data and operation instead of depending on a single external provider. The models run on infrastructure you control, the data never leaves your building, and no one can cut off your access through a contractual or political decision. Sovereignty is not all or nothing here, but a deliberate choice per use case, where independence is worth the effort.

For many use cases, yes. Modern open models like Llama, Mistral or Qwen now reach a quality that was reserved for cloud providers only a few years ago. For classification, summarisation, internal knowledge queries or document processing they are often more than sufficient. What matters is not the largest model, but the right model for the specific task, cleanly integrated and transparently evaluated.

That depends on your usage profile. Cloud APIs are cheap to get started and at low volume, but they get expensive quickly under sustained high throughput. A local solution incurs acquisition and operating costs, but it is predictable and independent of external providers' price changes. With sensitive data, the cloud is often simply not a permissible option at all. We work this out case by case instead of giving a blanket answer.

Above all organisations with sensitive data or a strong dependence on continuous availability: public administration, healthcare, insurers and companies with know-how worth protecting. Anyone who must demonstrate for regulatory reasons where data is processed also benefits. For non-critical tasks with fluctuating demand, the cloud often remains the more pragmatic choice.

Yes, and that is not a theoretical scenario. Access to cloud AI hangs on contracts, export rules and political decisions you have no influence over. A changed sanctions situation, a provider decision or a new regulatory requirement can cut off a service overnight. Whoever builds a business process firmly on an external service takes on that risk as well.

A twofold risk arises: legal, around data transfer to third countries (the Schrems II issue), and operational, around availability. Both lie outside your control. For non-critical tasks that is acceptable. For processes that have to keep running, or for sensitive data, it is a concentration risk that should be deliberately assessed and hedged.

Through independence in the right places: base critical processes on open models you can run locally, keep providers interchangeable instead of hardwiring them in, and have a fallback plan for the most important use cases. The point is not to demonise cloud AI, but to avoid being held hostage at the decisive points.

No. It is about a deliberate split: cloud AI where it is cheap and unproblematic, local and sovereign solutions where data is sensitive or an outage becomes expensive. The art lies in drawing the line correctly, not in a blanket decision for or against the cloud.

The Vellmerk Matrix is a simple 2x2 grid that sorts AI initiatives by impact and effort. From this come four fields: quick wins (high impact, low effort), strategic bets (high impact, high effort), gap fillers (low impact, low effort) and the effort trap (low impact, high effort). It helps you derive the right sequence from a long list of ideas.

By first sorting them by impact and effort, not by technical fascination. Start with quick wins that deliver visible value fast and build trust. Plan strategic bets deliberately and with a budget. Gap fillers get done on the side, and the effort trap is consistently left alone. That creates momentum instead of stalling on first steps that are too big.

Quick wins deliver impact fast with manageable effort, ideal for getting started and for building internal acceptance. Strategic bets have great potential but need more time, budget and appetite for risk. Both have their place but should not be confused: anyone planning a strategic bet as a quick win will fail on expectations.

Because the technically most exciting project often sits in the effort trap: lots of complexity, little measurable business value. First AI projects should show impact that the surrounding organisation understands and appreciates. Fascination is a poor guide for prioritisation; impact per unit of effort is the better one.

Because even the best model is only as good as the data it works on. Models today are largely interchangeable building blocks; the real value sits in your data and its quality. Poor, incomplete or unstructured data reliably leads to poor results, no matter how powerful the model.

Data quality means the data is available, accessible, consistent, current and sufficiently structured for the intended use case. It also means it is clear what the data means and where it comes from. For AI it is not the largest volume of data that counts, but the data basis that fits the task and is reliable.

No, and waiting for that would be a mistake. You do not need a perfect, company-wide data basis, but a good enough data foundation for the specific first use case. Data work and AI adoption run best in parallel: you start focused, learn, and keep improving the data basis where it pays off.

Getting an honest overview: what data exists, where it sits, in what quality, and who may use it. Only from this inventory does it become clear which use case will realistically work first. Often the biggest lever is not a new tool, but order and access to data you already have.

As long as a process follows clear, stable rules, rule-based automation is usually the better choice: cheap, traceable and reliable. AI only pays off once inputs are unstructured or ambiguous, such as free text, images or handwriting, or when the process requires judgement. The honest question is always: does this step really need AI, or does a clear rule suffice?

First, rule-based automation for clearly defined sequences. Second, AI-supported processes, where a model processes unstructured inputs or makes suggestions but the frame stays fixed. Third, autonomous AI agents that independently research, decide and act. Each level brings more possibilities, but also more effort for governance and quality assurance.

When multiple steps, changing conditions and independent decisions come together and the sequence cannot sensibly be cast into fixed rules. As long as a workflow or a model with a fixed frame is enough, an agent is unnecessary effort. Agents are the right tool for open, multi-stage tasks, not for every automation.

Using AI where a simple rule would have done. That makes the process more expensive, harder to trace and more error-prone, without real added value. Good automation uses only as much AI as necessary and as much clear rule as possible.

That depends on the material. Clean print only needs classic OCR. For difficult, mixed or poorly scanned originals, ICR with AI methods is more robust. Handwriting needs HTR with dedicated models. In practice the methods are usually combined. The most reliable way to see which mix fits is a short test with your real documents.

Considerably better than many expect. Modern HTR pipelines reach character-level error rates below five percent on average handwriting, often better. What matters is training the pipeline on your actual documents rather than on lab data. The robust answer always comes from a proof of concept with your real scans.

Often yes, but not always. For small, one-off volumes, manual capture can be cheaper. As soon as documents arrive regularly and in volume, or when structured, processable data is to be derived from them, an automated pipeline quickly pays off. The tipping point is best worked out concretely.

No. Especially with sensitive material like applications, files or health data, the entire recognition pipeline can run locally, without a single document leaving your building. Cloud services are an option for non-critical material, but not a prerequisite for good results.

Because the model delivers the technology, not the translation into your context. The real work lies in finding the right use case, bringing processes, data and people together, and reliably taking the solution into operation. No model does that by itself, and that is exactly why the need for consulting rises with the capability of AI rather than falling.

It shows that even the maker of the models knows: the technology alone generates no business value. It takes people who translate between use case and tool, sharpen requirements and accompany delivery. When the provider of the best models builds up consulting for that, it is a clear signal to everyone else.

It changes it but does not replace it. AI devalues the pure gathering and packaging of knowledge, that is, classic slide work. What gets upgraded, by contrast, is what AI cannot do: take responsibility, understand context, mediate between stakeholders and deliver execution dependably. Consulting shifts from analysis to execution.

Identify the right use case, say honestly when AI is not the right solution, factor in data protection and governance, and take the solution from idea through to stable operation. A model answers questions; a consultant takes responsibility for the outcome.

No, more of an upheaval. The image of a consulting collapse is overstated. What is really happening: the market is shifting away from thick slide decks and annual roadmaps towards fast, tangible execution in weeks. Consulting that only packages knowledge comes under pressure. Consulting that delivers wins.

AI takes over research, preparation and standard analyses that used to fill much of a consultant's time. As a result, the value of pure knowledge work falls and the value of execution, judgement and responsibility rises. Projects are cut smaller, faster and more strongly oriented towards measurable results.

Good news: high-quality consulting becomes more accessible. Lean, execution-strong providers can today deliver results that used to be reserved for large firms with large budgets. For SMEs and the public sector that means pragmatic, affordable AI projects with visible value instead of expensive strategy papers.

Look for someone who does not just advise but also builds. Ask about concrete projects delivered, about how they handle data protection, and for an honest assessment of when AI is not the right solution. Slide confidence alone is too little in the AI era.

Much speaks against there being a genuine technological pause. The pause narrative is mainly a matter of finance and expectation management, not a technical one. For decision-makers the relevant question is anyway not whether the industry pauses, but whether the tools available today are mature enough for their use case. In many cases they long since are.

The leaked figures for 2025 show a profitable product business and at the same time a multi-billion-dollar race: around 13 billion dollars in revenue stand against total costs of about 34 billion, of which a good 19 billion go to research and development alone. Put differently: the product pays for itself, the lead in the race is what costs the money.

By the figures, yes. The ongoing operation of the products covers its costs. The red numbers come from investments in the next model and the infrastructure, that is, from the race for the top, not from the product itself. This distinction matters when you put headlines about losses into context.

Do not wait for a supposed pause. The models available today are sufficient for the vast majority of business use cases. Whoever invests in execution now, in a focused way, instead of waiting for the next level, builds a lead. Business value comes from application, not from the latest benchmark.

The new name bundles the profile more clearly: AI consulting with depth of execution, carried by a person with a clear track record. Vellmerk.ai stands for the next step after moving into full self-employment, with a sharpened focus on sovereign, practical AI consulting.

For collaboration, little changes; for data protection, nothing to the detriment. Vellmerk.ai is a Danish ApS, but continues to work for the German-speaking region and relies on EU data storage and GDPR compliance. Consulting is flexible: remote, hybrid or on site.

Yes. Germany, Austria and Switzerland remain core markets, complemented by Denmark and international projects. Content appears in three languages: German, English and Danish. Proximity to SMEs and public administration in the German-speaking region remains central.

Sovereign means: solutions you can control. Where data protection and independence matter, we rely on local and on-premise AI, EU data storage and provider independence. Instead of leading you into a dependency, we build solutions that belong to you.